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Experimental realization of secure multi-party computation 
in an entanglement access network 


X.-Y. Chang^ D.-L. Deng^’i, X.-X. Yuan\ P.-Y. Hou\ Y.-Y. Huang\ L.-M. Duan^’i 

^ Center for Quantum Information, IIIS, Tsinghua University, Beijing 100084, PR China 
^Department of Physics, University of Michigan, Ann Arbor, Michigan 48109, USA 

To construct a quantum network with many end users, it is critical to have a cost-efficient way 
to distribute entanglement over different network ends. We demonstrate an entanglement access 
network, where the expensive resource, the entangled photon source at the telecom wavelength and 
the core communication channel, is shared by many end users. Using this cost-efficient entanglement 
access network, we report experimental demonstration of a secure multiparty computation protocol, 
the privacy-preserving secure sum problem, based on the network quantum cryptography. 
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The peculiar quantum correlation, entanglement, pro¬ 
vides the crucial resource for quantum information pro¬ 
cessing M. Generation of remote entanglement is a key 
step for quantum communication and distributed compu¬ 
tation 0, m . Distribution of entanglement in a multiple- 
end quantum network is costly through the point-to- 
point protocol as one needs to establish an entanglement 
source and a q uantum communication channel between 
each end We demonstrate a cost-efficient entan¬ 

glement access network where multiple end users share 
the same entanglement source and the core communi¬ 
cation channel. We verify entanglement and quantum 
nonlocality between different end users. Using this en¬ 
tanglement access network, we report the experimental 
demonstration of a secure multi-party computation pro¬ 
tocol where several end users compute cooperatively to 
solve a joint problem without revealing the information of 
their actual inputs [iMl. This demonstration opens up 
the prospect of applying the cost-efficient entanglement 
access network for achieving secure multi-party compu¬ 
tation that protects the privacy of end users. 

With popularity of the internet, distributed computa¬ 
tion becomes increasingly more important, where a num¬ 
ber of end users need to work cooperatively to solve a 
common problem. The answer to the problem typically 
depends on the inputs of all the end users, which need to 
be communicated in the network. At the same time, the 
users need to protect their privacy and do not want to re¬ 
veal their information to the others. Secure multi-party 
computation is a branch of cryptography and computer 
science that studies this kind of problems [HHil- A well- 
known primitive example of this field is the millionaire 
problem, first introduced by Yao 0 , in which two mil¬ 
lionaires want to know which of them is richer without 
revealing their actual wealth. Secure multi-party com¬ 
putation has many applications in e-commerce and data 
mining wher e peopl e need to compare numbers which are 
confidential Classically, the secure multi-party 

computation protocols typically rely on computational¬ 
ly hard mathematical problems, which require specific 
assumptions and are subject to security loopholes in par¬ 


ticular under attack by a quantum computer [T^ . 

In this paper, we demonstrate an entanglement ac¬ 
cess network which offers an alternative route for secure 
multi-party computation based on the network quantum 
cryptography. Quantum access network is a concept in¬ 
troduced in a recent paper where the emensive quantum 
resource is shared by many end users . For quan¬ 

tum key distribution based on the BB84 protocol (3, 
the photon detector is the relatively expensive part of its 
implementation and thus shared in the quantum access 
network demonstrated in Ref. jH. Here, we realize an 
entanglement access network to efficiently distribute en¬ 
tanglement between network end users. In this network, 
the entanglement source is the most expensive part of 
the implementation and thus shared between many end 
users. Entanglement provides the crucial quantum re¬ 
source for achieving device-independent quantum cryp¬ 
tography, the most secure way for cryptographic com¬ 
munication (Tsl-lioli- Entanglement is also the critical re¬ 
source for certified generation of shared randomness 
and for quantum communication and multi-party compu¬ 
tation through the entanglement-based schemes [3, {2 ^ . 
We demonstrate an entanglement access network which 
efficiently distributes entanglement between a number of 
end users connected through fibers of more than 20 km 
length by sharing a single entangled photon source at 
the telecom frequency. By use of this entanglement ac¬ 
cess network, we report experimental demonstration of 
a secure multi-party computation protocol, the secure 
sum problem, in which several millionaires want to know 
how much money they have in total but none of them 
is willing to reveal his wealth to others (illil- This 
demonstration shows that the entanglement access net¬ 
work provides a cost-efficient way to realize a quantum 
network with shared resource, opening up the prospect 
for its applications in secure multi-party cryptography 
and distributed quantum computation. 

The entangled photon source shown in Eig. 1(a) is 
generated by a type-II BBO crystal pumped by ultrafast 
laser pulses (with the pulse duration less than 150 fs and 
a repetition rate of 76 MHz) at the wavelength of 775 


2 


nm from a Ti:Sapphire laser. The spontaneous paramet¬ 
ric down conversion in the BBO crystal produces entan¬ 
gled photon pairs at the telecom wavelength of 1550 nm, 
which, in the ideal case, are in the polarization entan¬ 
gled state |T) = {\HV) -h \VH)) /\/2, where \H) and 
\V) denote respectively the horizontal and the vertical 
polarization state and (/:? is a controllable phase |23| | . We 
have verified that the experimentally generated state p 
has an entanglement fidelity Fg of (95.12 ± 0.25) % with 
respect to this ideal state |T) through the quantum state 
tomography m. 

The entangled photons at the telecom frequency are 
coupled into optical fibers representing the core commu¬ 
nication channel with the total distance about 20 km. 
The output photons from the fibers are fed into a 1 x 8 
optical switch at each side (called Alice’s and Bob’s side) 
which is electrically controlled by the computer to deliver 
the photons to one of the eight output ports according to 
the electric control signal. This forms an entanglement 
access network with 8x8 possible choices of pairs of end 
users who can share entangled photons with the entangle¬ 
ment distance more than 20 km, as shown in Fig. 1(b). 
All the end users share the same entanglement source 
and the core communication channel. The polarization 
states of photons are subject to tension and tempera¬ 
ture dependent rotations in the optical fibers which are 
carefully compensated afterwards through the fiber po¬ 
larization controllers. 

To demonstrate entanglement between different end 
users, we randomly choose two users Ai and A 2 at 
Alice’s side and two users Bi and B 2 at Bob’s side. 
For the four pairs of end users AiBj {i^j = 1,2), we 
measure their entanglement by detecting the photon co¬ 
incidences in different polarization bases. To rotate 
the polarization basis, we use a fast switchable elec¬ 
tric optical modular (EOM), which induces a polariza¬ 
tion transformation \H) cos0\H) — ismO\V) and 
\V) ^ —i sin^ |i^)+cos^ \ V) with the angle 0 determined 
by the computer controlled electric signal. The output H 
and V polarized photons are split by a polarization beam 
splitter (PBS) and then detected through single photon 
counters. In the Z (or X) basis detection, we register the 
photon coincidence counts by fixing the angle Oa of Ai at 
0^ (or 45^) and rotating the angle Ob of Bj. The result¬ 
ing coincidence counts as functions of the angle Ob are 
shown in Fig. 2 for different pairs AiBj. The big contrast 
of these oscillations is a clear demonstration of quantum 
entanglement. Quantitatively, we calculate the visibili¬ 
ties of these oscillation curves W and Vx in the Z and the 
X basis, respectively, and the entan glem ent fidelity is 
then bounded by Fe > (Vz + i4)/2 [25|. The visibilities 
and the corresponding fidelity bounds are listed in Fig. 
3. All the pairs have the entanglement fidelity higher 
than 90%. The small decrease of the entanglement fideli¬ 
ty compared with the fidelity Fg of the entangled photon 
source is due to the imperfection in compensation of the 
polarization rotation in the optical fibers. 

The shared entanglement allows demonstration of 
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FIG. 1. The experimental setup for implementa¬ 
tion of an entanglement access network, (a) The setup 
to generate the polarized entangled photons at the telecom 
wavelength. The ultrafast pulse at the 775 nm wavelength 
from the TiiSapphire laser is i7-polarized and focused by lens 
onto the BBO crystal cut in the Type-II phase-matching con¬ 
dition, generating polarized entangled photons at the 1550 
nm wavelength. To ensure entanglement, we use a compen¬ 
sator made by another BBO crystal at each output, which 
compensates the temporal walk-off between the H and V po¬ 
larized photons in the nonlinear crystal. The output photons 
are filtered by 3 nm interference filters and then coupled into 
long-distance optical fibers with a fiber coupler. The half¬ 
wave plates (HWP) are used for alignment of the polarization 
axes before and after the fibers, (b) The setup to construct an 
entanglement access network , where the entanglement source 
and the core communication channel are shared by many end 
users. Computer controlled optical switches are used to dis¬ 
tribute the entangled photons to different end users. Our ex¬ 
periment demonstrates an entanglement access network with 
up to 8 X 8 end users, where the two sides are separated by 
a fiber about 20 km. Among the end users, we have verified 
entanglement and quantum nonlocality between four pairs of 
them and used the shared entanglement to demonstrate the 
four-party secure sum protocol as an example to illustrate its 
application for implementation of secure multi-party compu¬ 
tation. 


quantum key distribution between any pair of the end 
users in this network using the Ekert protocol [2|. Eor 
this purpose, we need to randomly choose the angle 
Oa from the set {0^, 22.5^, 45^} and Ob from the set 
{22.5^,45^,67.5^}, and record the individual measure¬ 
ment outcomes for each coincidence count |26j |. Erom 
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FIG. 2. The entanglement demonstrated between 
different pairs of the end users. The figures show the co¬ 
incidence counts when we fix the rotation angle of the electric 
optical modulator (EOM) of one end at 0^ (for the Z-basis) 
or 45^ (for the X-basis) while rotating the angle of the EOM 
at the other end. Different sub-figures correspond to different 
pairs of parties (Ai and Bi, Ai and B 2 , A 2 and Bi, A 2 and 
B 2 ). The visibilities of the oscillations in the X and the Z 
bases together bound the entanglement fidelity of the pho¬ 
tonic states shared between the corresponding parties. 


the counts for the angles Oa = {0^,45^} and Ob = 
{22.5^,67.5^}, we calculate the expectation value of the 
Clauser-Horne-Shimony-Holt (CHSH) observable (S) = 
(0^22.5^) + (45^22.5^) + (45^67.5^) - (0^67.5^) 
where {Oa^Ob) denotes the photon coincidence counts 
with Oa^Ob at the specified values. The CHSH values 
are listed in Fig. 3 for different pairs Ai^Bj. The CHSH 
inequality {S) < 2 for any classical correlation is clearly 
violated, demonstrating quantum nonlocality. The sig¬ 
nificant violation of the CHSH inequality for each pair 
of the end users is a guarantee of the security of the 
entangled-based QKD protocol To generate 

quantum key, the measurement outcomes dX Oa = Ob = 
{22.5^,45^1 are kept, which yield the sifted keys ( 2 ^ . 
For each pair of the parties, we obtain roughly 1.2 x 10^ 
sifted keys. We randomly choose 20% of the keys to 
estimate the quantum bit error rate (QBER). For our 
data, the QBER 7 is about 5%, smaller than the securi¬ 
ty threshold of 11% 1^. W e use the low density parity 
check (LDPC) code [^.1^ to do the error correction for 
the sifted keys, which is more efficient compared with the 
conventional CASCADE protocol ( 2 ^ . We obtain about 
8000 error-free shared keys, which are then purified by 
the privacy arnplification protocol via a universal- 2 -class 
hash function [^, yielding about 1800 shared secret final 
keys. The residual information available to any potential 
eavesdroppers is reduced by a factor of 2 “^^^ during the 
privacy amplification and thus much less than one bit. 

We now use the entanglement access network to 
demonstrate a secure multi-party computation protocol: 
the privacy-preserving secure sum problem | 1 ^ . The 



Z basis visibility 

X basis visibility 

Fidelity bound 

CHSH Value 

A^Bi 

(91.68+0,21)% 

(88.76 +0,32)% 

(90.22+0,26)% 

2,428+0,020 


(92,59+0,19)% 

(88.11 +0,30)% 

(90,35+0,24)% 

2,449+0,019 

A 2 B 1 

(94.10+0.18)% 

(87.91 +0.36)% 

(91.01+0.27)% 

2.453+0.020 

A 2 B 2 

(93.54+0.16)% 

(86.73 +0.32)% 

(90.14+0.24)% 

2.458+0.021 


EIG. 3. The experimental data to show entangle¬ 
ment and quantum nonlocality shared between dif¬ 
ferent parties. The table lists the oscillation visibilities of 
the coincidence counts in the Z and the X bases, whose av¬ 
erage gives a lower bound to the entanglement fidelity (the 
fourth column). The error bars are obtained by assuming a 
Poissionian distribution for the photon counts and propagated 
from the measured coincidence counts to the quantities list¬ 
ed in the table through exact Monte Garlo simulation. The 
last column of the table shows the measured value for the 
GHSH observable, and a larger-than-2 value indicates viola¬ 
tion of the Bell inequality, demonstrating quantum nonlocal¬ 
ity shared between the corresponding parties. 


problem can be illustrated with the following example: 
assume several millionaires want to know how much mon¬ 
ey they have in total, but none of them want to reveal 
his actual wealth to others. To be concrete, we consider 
the case of four parties Ai, A 2 , Hi, H 2 . Denote by ai, a 2 , 
hi and 62 the input from Ai, A 2 , Hi, H 2 , respectively. 
We want to calculate the sum T = ai + a 2 + 5i + 62 
without revealing the inputs ai,a 2 , 61 , 62 . The quantum 
protocol to accomplish this task using the entanglement 
access network goes as follows: 

Step 1 .—Using the entanglement-based network QKD, 
Ai and Hi, Hi and A 2 , A 2 and H 2 , and H 2 and Ai share 
random keys of n bits denoted by IZa^b^ Ha 26 i, ^.0362 5 
and 7^01625 respectively. The number of bits n is taken 
to be at least as large as the estimated number of bits 
for the sum T. 

Step 2 .—Ai calculates Xi = ai + 7^ai6i “ '^aib 2 
publicly announces Xi to others; Hi calculates X 2 = 
61 -\-IZa 2 b 1 — 'Tlaibi and publicly announces X 2 to others; 
A 2 calculates X 3 = a 2 + ^0362 “ '^a 2 bi and publicly an¬ 
nounces X 3 to others; H 2 calculates X 4 = 62 + 'Tlaib 2 ~ 
7 la 2 b 2 and publicly announces X 4 to others. 

Step 3 .—All of them know the sum T by calculating 
T = Xi X 2 + X 3 + X 4 . At the same time, the inputs 
ai,a 2 , 6 i ,62 remain confidential to the other parties as 
the public information Xi {i = 1,2, 3,4) has no corre¬ 
lation with the inputs due to the one-time pad theorem. 
For security of this secure sum protocol, we have assumed 
that different parties do not collaborate to steal the input 
information of the other parties. With the sum T, when 
a few parties collaborate, it is always possible to reveal 
the input information of the other party. 

In the experimental demonstration, as an example. 
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FIG. 4. The experimental demonstration of the four- 
party secure-sum protocol through the entanglement 
access network. The top four sub-figures show the pub- 
lically announced data from each of the four parties for 30 
rounds of experiments for demonstration of the same secure- 
sum problem with the same input from each party. The ran¬ 
domly distributed data over different experimental runs is an 
indication that the announced data reveal no information of 
the input from each party. The last sub-figure shows the 
secure sum calculated by each party from the publically an¬ 
nounced data, which is identical for different experimental 
runs and always equal to the true value of the sum for the 
underlying problem. 


we take randomly generated numbers ai = 55406, 
bi = 116559, a 2 = 988150 and 62 = 2839885. We 
run the above implementation of the secure sum pro¬ 
tocol 30 times, and for each time we use different keys 
^ 0261 , ^02625 ^ai 62 ^ith the number of bits n = 25 
bits to encode the public information Xi, X 2 , X 3 , X 4 . For 
these 30 experimental runs, the publicly announced num¬ 
bers Xi, X 2 , X 3 , X 4 are shown in Fig. 4, which look com¬ 
pletely random from trial to trial and reveal no informa¬ 
tion of the inputs ai,a 2 , 5 i, 62 - However, for each run, 
their sum is always fixed to be 4 x 10^, which gives the 
correct calculation result for T = ai + a 2 + + 62 . 

Similar to the quantum access network realized recent¬ 
ly jll, we expect that the entanglement access network 
demonstrated in this paper provides a source-efficient 
way for network cryptography and secure multi-party 
computation. In particular, the shared entanglement be¬ 
tween each ends of the network opens up the possibility to 
realize device independent quantum cryptography |l5l - 
fl^ , which allows most secure communication by closing 
the practical security loopholes in conventional quantum 
cryptography in. Apart from the example demonstrat¬ 
ed in this paper, the entanglement access network may 
allow realization of a number of secure multi-party com¬ 
putation problems (l^ . The entanglement shared in the 
network could also find a ppli cations for certified genera¬ 
tion of random numbers |2lj | and for implementation of 
distributed quantum computation and multiparty quan¬ 
tum cryptography protocols Hi- 
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